Python检测PE所启用保护方式详解

Python 通过pywin32模块调用WindowsAPI接口，实现对特定进程加载模块的枚举输出并检测该PE程序模块所启用的保护方式，此处枚举输出的是当前正在运行进程所加载模块的DLL模块信息，需要用户传入进程PID才可实现输出。

• 首先需要安装两个依赖包：
• pip install pywin32
• pip install pefile

然后再命令行模式下执行命令启动枚举功能。

# By: LyShark
import win32process
import win32api,win32con,win32gui
import os,pefile,argparse

def Banner():
    print(\"  _          ____  _                _    \")
    print(\" | |   _   _/ ___|| |__   __ _ _ __| | __\")
    print(\" | |  | | | \\___ \\| \'_ \\ / _` | \'__| |/ /\")
    print(\" | |__| |_| |___) | | | | (_| | |  |   < \")
    print(\" |_____\\__, |____/|_| |_|\\__,_|_|  |_|\\_\\\\\")
    print(\"       |___/                             \\n\")
    print(\"E-Mail: me@lyshark.com\")

def GetProcessModules(pid):
    ModuleList = []
    handle   = win32api.OpenProcess(win32con.PROCESS_ALL_ACCESS, False, pid )
    hModule  = win32process.EnumProcessModules(handle)
    for item in hModule:
        Module_Addr = hex(item)
        Module_Path = win32process.GetModuleFileNameEx(handle,item)
        Module_Name = os.path.basename(str(Module_Path))
        ModuleList.append([Module_Addr,Module_Name,Module_Path])
    win32api.CloseHandle(handle)
    return ModuleList

def CheckModulesProtect(ClassName):
    UNProtoModule = []
    if type(ClassName) is str:
        handle = win32gui.FindWindow(0,ClassName)
        threadpid, procpid = win32process.GetWindowThreadProcessId(handle)
        ProcessModule = GetProcessModules(int(procpid))
    else:
        ProcessModule = GetProcessModules(int(ClassName))
    print(\"-\" * 100)
    print(\"映像基址\\t\\t模块名称\\t基址随机化\\tDEP保护兼容\\t强制完整性\\tSEH异常保护\")
    # By: LyShark.com
    print(\"-\" * 100)

    for item in ProcessModule:
        pe = pefile.PE(item[2])
        DllFlage = pe.OPTIONAL_HEADER.DllCharacteristics
        print(\"%10s\"%(item[0]),end=\"\\t\")
        print(\"%21s\"%(item[1]),end=\"\\t\")

        # 随机基址 => hex(pe.OPTIONAL_HEADER.DllCharacteristics) & 0x40 == 0x40
        if( (DllFlage & 64)==64 ):
            print(\" True\",end=\"\\t\\t\") 
        else:
            print(\" False\",end=\"\\t\\t\")
            UNProtoModule.append(item[2])
        if( (DllFlage & 256)==256 ):
            print(\"True\",end=\"\\t\\t\")
        else:
            print(\"False\",end=\"\\t\\t\")
        if ( (DllFlage & 128)==128 ):
            print(\"True\",end=\"\\t\\t\")
        else:
            print(\"False\",end=\"\\t\\t\")
        if ( (DllFlage & 1024)==1024 ):
            print(\"False\",end=\"\\t\\t\\n\")
        else:
            print(\"True\",end=\"\\t\\t\\n\")
    
    print(\"-\" * 100)
    print(\"\\n[+] 总模块数: {} 可利用模块: {}\".format(len(ProcessModule),len(UNProtoModule)),end=\"\\n\\n\")
    for item in UNProtoModule:
        print(\"[-] {}\".format(item))
    print(\"-\" * 100)

if __name__ == \"__main__\":
    Banner()
    parser = argparse.ArgumentParser()
    parser.add_argument(\"-H\",\"--handle\",dest=\"handle\",help=\"指定一个正在运行的进程Handle\")
    parser.add_argument(\"-P\",\"--pid\",dest=\"pid\",help=\"指定一个正在运行的进程PID\")
    args = parser.parse_args()
    if args.handle or args.pid:
        if args.handle:
            CheckModulesProtect(str(args.handle))
        elif args.pid:
            CheckModulesProtect(int(args.pid))
    else:
        parser.print_help()

输出枚举效果如下：